Description
In the Linux kernel, the following vulnerability has been resolved:

thunderbolt: Don't access a DP tunnel after its DPRX read was canceled

tb_dp_dprx_work() checks ->dprx_canceled before it takes tb->lock so it
misses a tb_dp_dprx_stop() that could not cancel the already running
work. It then polls the DPRX capabilities and runs the callback for a
tunnel that has already been torn down while the domain is suspending or
going away.

This can be hit by cancelling the DPRX read from outside the ordered
tb->wq: During suspend tb_disconnect_and_release_dp() does just this and
with a later patch tb_stop() will do it as well. The latter in combination
with the Apple NHI where the DPRX read never completed is how I hit
this.

Check the flag with tb->lock held instead and check it again in
tb_dp_tunnel_active() because the callback runs after the lock has been
dropped again.

Also clear the flag in tb_dp_dprx_start() so that it only ever describes
the work that is currently in flight.
Published: 2026-10-18
Score: n/a
EPSS: n/a
KEV: No
Impact: Denial of Service via Kernel Crash
Action: Apply Patch
AI Analysis

Impact

A race condition exists in the Linux kernel Thunderbolt driver. The routine bypasses synchronization when checking a cancellation, allowing a later cancellation to unsafely remove a DP tunnel while work is still pending. This causes the driver to read capabilities and invoke callbacks for a tunnel that has already been torn down, potentially accessing invalid memory and triggering a kernel panic or other crash. The flaw is rooted in improper locking and concurrent resource cleanup.

Affected Systems

All Linux kernel builds that include the default Thunderbolt implementation are vulnerable. The issue applies to every distribution using the stock kernel until the patch that fixes the race condition is applied.

Risk and Exploitability

The EPSS score is not available and the vulnerability is not in CISA’s KEV catalog, yet the impact of a kernel crash is severe. An attacker with local access to a device connected via Thunderbolt, or one who can force the system to suspend or disconnect the device, can trigger the fault. Dishonored race conditions between workqueue callbacks and device removal expose the kernel to use‑after‑free or data corruption, enabling denial of service. Because exploit availability is currently unspecified, organizations should treat this as a high‑risk local vulnerability pending patch.

Generated by OpenCVE AI on October 18, 2026 at 22:16 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update the Linux kernel to the latest stable release that includes the patch for CVE-2026-98689
  • Avoid suspend or hot‑plug events that trigger Thunderbolt DP tunnel teardown when a compatible device is connected
  • If a patch is not immediately available, disable Thunderbolt DP functionality or remove vulnerable devices until a fix is applied

Generated by OpenCVE AI on October 18, 2026 at 22:16 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 18 Oct 2026 22:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-416
CWE-847

Sun, 18 Oct 2026 16:00:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Don't access a DP tunnel after its DPRX read was canceled tb_dp_dprx_work() checks ->dprx_canceled before it takes tb->lock so it misses a tb_dp_dprx_stop() that could not cancel the already running work. It then polls the DPRX capabilities and runs the callback for a tunnel that has already been torn down while the domain is suspending or going away. This can be hit by cancelling the DPRX read from outside the ordered tb->wq: During suspend tb_disconnect_and_release_dp() does just this and with a later patch tb_stop() will do it as well. The latter in combination with the Apple NHI where the DPRX read never completed is how I hit this. Check the flag with tb->lock held instead and check it again in tb_dp_tunnel_active() because the callback runs after the lock has been dropped again. Also clear the flag in tb_dp_dprx_start() so that it only ever describes the work that is currently in flight.
Title thunderbolt: Don't access a DP tunnel after its DPRX read was canceled
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-10-18T15:46:04.217Z

Reserved: 2026-09-25T10:25:14.364Z

Link: CVE-2026-98689

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-18T16:17:22.317

Modified: 2026-10-18T16:17:22.317

Link: CVE-2026-98689

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-18T22:30:13Z

Weaknesses